fix: serialize NGX read_intensities and stop unactivated ScanManager …

[jirhiker]

…from starting scan timer

NGX socket reads were racing between MultiCollector and ScanManager Timer threads, garbling TCP bytes and triggering duplicate StartAcq (E43) once integration_time changed mid-run.

• Wrap NGX read_intensities in microcontroller.lock so trigger_acq + readline cycles serialize across threads. The lock was already initialized in NGXController but every call site was commented out. ask() uses a separate communicator lock so valve/source commands are unaffected.
• Default _streaming_active to False so the plugin-instantiated singleton ScanManager does not start a scan timer until activate() runs (window opens).
• Gate _integration_time_changed on _streaming_active to skip the redundant StopAcq/SetAcqPeriod and the auto reset_scan_timer fired by the DelegatesTo notification when AutomatedRun changes spectrometer.integration_time.

Summary

• Describe the user-facing or developer-facing change.
• Keep this focused on what changed and why.

Context

• Why is this change needed?
• What problem does it solve?

Verification

• Tests added or updated where appropriate
• Local verification completed
• CI is expected to pass

Verification details:

• ...

Risk

• Note behavioral risk, migration risk, hardware risk, or data risk.
• If low risk, say so explicitly.

Target Branch Check

• This PR targets the branch it was created from logically (develop, the active dev/* stream, release/*, or hotfix/*)

Follow-ups

• Optional follow-up work, cleanup, or known limitations.